CVE-2026-83494

A vulnerability exists in the training-operator where incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass managedby immutability checks. This flaw could enable a user to detach a queued job from its quota management system or hijack the controller ownership of...

BIT-PARSE-2026-116163 Parse Server 9.0.0 before 9.10.5 Authentication Bypass via AuthAdapter Subclasses

Parse Server before 8.6.102 and 9.0.0 before 9.10.5 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can...

CVE-2026-116163

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead...

CVE-2026-116163 Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead...

CVE-2026-116163

Parse Server versions before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 are vulnerable to an authentication bypass via custom adapters subclassing AuthAdapter . The root cause is that the validateSetUp, validateLogin, and validateUpdate methods of these custom adapters are never invoked, causing the...

CVE-2026-116163 Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead...

CVE-2026-116163

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead...

CVE-2026-116163 Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead...

EUVD-2026-109424

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead...

PT-2026-123004

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.102 Parse Server versions 9.0.0 through 9.10.5-alpha.1 Description An authentication bypass exists because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapt...

Parse Platform Parse Server authorization issue vulnerability

Versions prior to 8.6.102 and versions 9.0.0 through 9.10.5-alpha.2 of the Parse Platform’s Parse Server contain an authorization issue vulnerability. This vulnerability arises because the validateSetUp, validateLogin, and validateUpdate methods inherited from AuthAdapter are not invoked via cust...

Improper Input Validation

github.com/cometbft/cometbft is vulnerable to Improper Input Validation. The vulnerability is due to the ValidateUpdate function within params.go because there is no proper validation for the VoteExtensionsEnableHeight. This allows an attacker to potentially cause a chain halt when exploited...